Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

1/21/2011
07:15 PM
Connect Directly
Google+
LinkedIn
Twitter
RSS
E-Mail
50%
50%

Mozilla Blocks Buggy Skype Toolbar

Responsible for over 40,000 Firefox crashes last week, the Skype Toolbar has been temporarily blocked.

Top 10 Security Stories Of 2010
(click image for larger view)
Slideshow: Top 10 Security Stories Of 2010

Mozilla on Friday said that it has added the Skype Toolbar to the Firefox Blocklist because the browser extension is buggy.

Users who have installed the Skype Toolbar will be notified that the toolbar has been disabled and presented with the option to re-enable it. But that probably wouldn't be a good idea.

The Skype Toolbar, said AMO, Mozilla's add-on management group, was responsible for over 40,000 Firefox crashes last week and was one of the "top crashers" of Firefox 3.6.13. And beyond that instability, AMO claims that the Skype Toolbar uses inefficient code that can slow Web page rendering by a factor of 300.

"We believe that both of these items constitute a major, user-facing issue, and meet our established criteria for blocklisting an add-on," said AMO in a blog post.

The Skype Toolbar extension for Firefox is bundled with Skype's desktop application, so users of Skype's desktop software may have installed the toolbar without being aware of it. In the past, this was an issue: In 2008, if not more recently, Skype's installer software did not notify users during upgrades that the toolbar extension was being installed, a fact that annoyed some users.

AMO said that it has contacted the Skype Toolbar team and is working to resolve the issue. When that happens, the software will be removed from the blocklist.

In July, AMO identified a malicious add-on, "Mozilla Sniffer," that had been blocklisted, along with an add-on called CoolPreviews that contained a significant vulnerability. The group made a similar announcement in last February, when it identified two malicious add-ons.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 5/22/2020
The Problem with Artificial Intelligence in Security
Dr. Leila Powell, Lead Security Data Scientist, Panaseer,  5/26/2020
How an Industry Consortium Can Reinvent Security Solution Testing
Henry Harrison, Co-founder & Chief Technology Officer, Garrison,  5/21/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
How Cybersecurity Incident Response Programs Work (and Why Some Don't)
This Tech Digest takes a look at the vital role cybersecurity incident response (IR) plays in managing cyber-risk within organizations. Download the Tech Digest today to find out how well-planned IR programs can detect intrusions, contain breaches, and help an organization restore normal operations.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-10737
PUBLISHED: 2020-05-27
A race condition was found in the mkhomedir tool shipped with the oddjob package in versions before 0.34.5 and 0.34.6 wherein, during the home creation, mkhomedir copies the /etc/skel directory into the newly created home and changes its ownership to the home's user without properly checking the hom...
CVE-2020-13622
PUBLISHED: 2020-05-27
JerryScript 2.2.0 allows attackers to cause a denial of service (assertion failure) because a property key query for a Proxy object returns unintended data.
CVE-2020-13623
PUBLISHED: 2020-05-27
JerryScript 2.2.0 allows attackers to cause a denial of service (stack consumption) via a proxy operation.
CVE-2020-13616
PUBLISHED: 2020-05-26
The boost ASIO wrapper in net/asio.cpp in Pichi before 1.3.0 lacks TLS hostname verification.
CVE-2020-13614
PUBLISHED: 2020-05-26
An issue was discovered in ssl.c in Axel before 2.17.8. The TLS implementation lacks hostname verification.